3 ms·

I realize criticism is cheap, and I like seeing small projects like this to explore other people's mind, but: What's the reason for the valid_url_pattern in sh

I realize criticism is cheap, and I like seeing small projects like this to explore other people's mind, but: What's the reason for the valid_url_pattern in shortener.js? /https?:\/\/([-\w\.]+)+(:\d+)?(\/([\w/_\.]*(\?\S+)?)?)?/ Why? This seems to be broken by design (I can construct invalid urls that match and find valid urls that don't. What's the idea behind this expression, why is it necessary? And looking at the code it just seems to prepend 'http:// http:// to the url if it doesn't match this expression?

dtreacy 15y ago
If you're able to input invalid URL's I guess I didn't test the regex thoroughly enough ;) I'll look into it. The prepending "http" is just a lazy hack to handle the case where they enter "google.com" instead of "http://www.google.com http://www.google.com, which would fail the regex, but is a valid URL. This would be deprecated by improving the regex validation. Keep in mind I threw this together in an afternoon.... But thanks for the critique ;)
- inakiabt 15y ago
  Maybe adding a simple "^" at the begining of the regex should be enough :) /^https?:\/\/([-\w\.]+)+(:\d+)?(\/([\w/_\.]*(\?\S+)?)?)?/ Otherwise, could be used for XSS. Like this url (http://naurls.me/39696e http://naurls.me/39696e): javascript:<script>alert('HELLO world');</script>http://naurl.me/